ci: Add linter

.github/workflows/ci-check-pr-title.yml

@@ -0,0 +1,18 @@
+name: CI / Check PR Title
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, edited]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  validate:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+    - uses: amannn/action-semantic-pull-request@v5
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci-lint.yml

@@ -0,0 +1,21 @@
+name: CI / Lint
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: astral-sh/setup-uv@v5
+    - run: |
+        git fetch --depth=1 origin ${{ github.event.pull_request.base.sha }}
+        git fetch --depth=1 origin ${{ github.event.pull_request.head.sha }}
+        uv run pre-commit run \
+          --from-ref ${{ github.event.pull_request.base.sha }} \
+          --to-ref ${{ github.event.pull_request.head.sha }} \
+          --show-diff-on-failure \
+          --color always

.github/workflows/ci-tests.yml

@@ -0,0 +1,15 @@
+name: CI / Tests
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: astral-sh/setup-uv@v5
+    - run: uv lock --check
+    - run: uv run pytest ./tests/

.github/workflows/release-publish.yml

@@ -0,0 +1,32 @@
+name: Release / Publish to PyPI
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: astral-sh/setup-uv@v5
+    - run: uv build
+    - uses: actions/upload-artifact@v4
+      with:
+        name: dist
+        path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: dist/
+    - uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        attestations: true

.pre-commit-config.yaml

@@ -1,28 +1,34 @@
-repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-      - id: check-added-large-files
-        args: ['--maxkb=128']
-      - id: check-ast
-      - id: check-case-conflict
-      - id: check-illegal-windows-names
-      - id: check-json
-      - id: check-merge-conflict
-      - id: check-toml
-      - id: check-yaml
-      - id: debug-statements
-      - id: detect-private-key
-      - id: end-of-file-fixer
-      - id: mixed-line-ending
-      - id: no-commit-to-branch
-        args: [--branch, master]
-      - id: trailing-whitespace
-        args: [--markdown-linebreak-ext=md]
-
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.13
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-      - id: ruff-format
+repos:
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c    # v6.0.0
+  hooks:
+  - id: check-added-large-files
+    args: [--maxkb=128]
+  - id: check-ast
+  - id: check-case-conflict
+  - id: check-illegal-windows-names
+  - id: check-json
+  - id: check-merge-conflict
+  - id: check-toml
+  - id: check-yaml
+  - id: debug-statements
+  - id: detect-private-key
+  - id: end-of-file-fixer
+  - id: mixed-line-ending
+  - id: no-commit-to-branch
+    args: [--branch, master]
+  - id: trailing-whitespace
+    args: [--markdown-linebreak-ext=md]
+
+- repo: https://github.com/macisamuele/language-formatters-pre-commit-hooks
+  rev: 4380fbb73a154b5f5624794c1c78d9719ccc860f    # v2.16.0
+  hooks:
+  - id: pretty-format-yaml
+    args: [--autofix, --indent, '2']
+
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: 22f0422809455ec89ffdcf5a00170ba816e42ddb    # v0.15.16
+  hooks:
+  - id: ruff-check
+    args: [--fix]
+  - id: ruff-format